b215cd2ad7644099f3902715ffe274f65849cd6a363f205e2a2ea00c261062a3

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

archive_browser.html
Size

741KB
MD5

584b1b233d50ab80a73819dbe8e9854c
SHA1

c6d658bffab7ef8455f3d1df3a2975fbaccc795e
SHA256

b215cd2ad7644099f3902715ffe274f65849cd6a363f205e2a2ea00c261062a3
SHA512

793844ee439062f290e1351cc4d81360c36c6e092fd88337834775f1dc1a1189bbafb70a4eff907125948530e7d985fe92adfaaa0ce1014b986c8e037f4f2bb7
SSDEEP

12288:DuM2ywRuI368piPekCT9w3VHyshG87cmNH/ofzW5kaERf6Y+xlweQkWyiyNBZmBH:iB368piP9CTiglhHKlTzFtP9XM9rlGu3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000f207693588d5f95a13ba1b6150afb49c1acb906c8913a587d8723001a635288b000000000e80000000020000200000007f8ba3214ac5ba0e94255954d56861657d8f8f5c14367b8c29fa3533f41add0a20000000cef69401c05c71e1edc2ae862950402cb82dd03b032d6c47784d2c2ed46d935d40000000dfa5c83ae13f0e384573a089b2b77bf2252b65514174894f1055d9145dc33a0bd716edaa6bef0a9cfcdf0693ef9b5267bc01489ed62f692db192f13b638efbbb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCD517B1-685E-11EF-888D-D67B43388B6B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000ed0ea57364581dc6509ed5711d25b979434d05e2fe65a1246972d3335998bbe3000000000e80000000020000200000005023705fecc4f961679dab59e2b19664b33761dd1cc01eb2504ef7dd20680b1a90000000db5508a399e44403efec5625982b857663f36a82e5fe261c92c10dc87445fc0f83330404c4ff9267b7d8307a163493903b786be08f514361e7048987cdb2883621ea294354006204a2e8c96d73373f5611f8e8c07b6d13f8f836e2bcc74bfe2949611316d8ff34c70f668063079c68eaa782828d989f3ac4dc26d09f90c196ad781ca8202c3b5ed4c8304cc37261d91e40000000da2858e9aede92462ef0dd187466b161600805ff8917f3bc4b71fe72fcdaee536f02234eb6fd5d1d166de376e3d9b7e6ca15018776a42bc262f29ee06472dff9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09576b16bfcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431356079"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1908	iexplore.exe
1908	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2528	1908	iexplore.exe	31
PID 1908 wrote to memory of 2528	1908	iexplore.exe	31
PID 1908 wrote to memory of 2528	1908	iexplore.exe	31
PID 1908 wrote to memory of 2528	1908	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\archive_browser.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0edbe753c0d11101d921599841ba9525

SHA1
2663d38bc84a802995759158824218f088d07617

SHA256
a0bb882c6cd650c37d30265d95d8b9f37b0e6f9712ef6eb1707c204d7e121b31

SHA512
17ade63e264783781d031b10fcae2f8ef4e4f91f7cfc30c9151430f18d8398a1a293fda65e3a930a4786f2e4b7959cd150ebe175e0627477afeff38f342c56bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9097c91917ee729a45cf6497c4d8f641

SHA1
f579a57a4baa81fdbfb740a8d8e1250930819878

SHA256
4348e55f1a8cb7063b343f1151f4c3ef57a79af209fa6cce4b4df1c483f1417c

SHA512
02cd194b833eb2888a62a5f805c4621a55d807d608109f9497362c84a2e38e764ee5fab8dc8224eb798587290d212397e000f16e1e3229cbd69eaaf9467efdf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
534fa5dd5241b720638b65654f6d68d3

SHA1
fb1bf9284e09b90220d7464f6565fd86aa3aacff

SHA256
bc9aa135a513b5747016b23718d0edd9b2a9ffc01b961c9016305a36bb3fc753

SHA512
cb2d31cd9e6af7b1c9d5944bdf49afbccc0625bb5f51077597b0d70b74d99382376d5e2838d2ed61068c4692ad1a89910f75dee40a9ee94ee3c44bc09d3c0f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80841af41cd0d3ac6569e024ce9a3e4b

SHA1
f5c3eb2624619c2ef16175d740dcbaba85e82eb9

SHA256
6804d87d6296b72027d39edf6c4e16ee3ac336dda2b5d7f3284a980ba25a4637

SHA512
a11b58a2ce3dc38e01fa1459845e87f66d902dd051f36a19df850ce1514fd270322bffb6a280ce7c36273f1b2e230a15b325d982d8432e2aa6f695df123b2851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7670ab69a0ce47f4320ec7f320833a6d

SHA1
7bc6ba81a414d8fd25184b7e4cfe98c69cf1d8cb

SHA256
cadaf5347e31c0234e1ec737ae7ae14dd83e78d491d50dd6cc6db4df3a21d547

SHA512
e30f3163f81c7b85fcb222b2ac1d0f8053d61274ec47524f710eae58d05fd6049db102990fa6265d553ab752589a7b99a72be34648e00c117545a1d95b3f5452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4189e3911a6b21602287d6cadd09fa99

SHA1
645b504a90636723ce4ba5a3f255c154a19f1e4d

SHA256
9c647ab3e4e3d699dca214cb9b74f83a5eeab57fb2732f6bd8656030e37eddf7

SHA512
c41be4541a50e1cd166b417d50d7a29d995f355376fd1223dadd80d5261374d40b023babafb916ddb1edd35108a3a491a28ffae0c576974e8a9ca855cc145ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ff4e737c19bd5a5f9e4208e64892a4a

SHA1
1a409fb71b56849e58dd8740a9372dadf2fc4c64

SHA256
58b01af83a7f8035e8aa92c0df29c8c4bcf0203c15157c2377689116f462bbbe

SHA512
c90cb40e1322484cfddd5f96478986d4104c3b55c05decd1511ef69b8fa53e2c594aa7a8a52d7ea66bd0314f152746a0a5e3544144b665e936a9e3139ea62684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cd9f13092aad1d04b9c7ff3efe669c2

SHA1
014e0c3311ef4989ddca4944fdaa565b69c38191

SHA256
ad54085b5433d025205e775d9b69e953dccb1458dfe66fcd8b733ad0b0eaa4a3

SHA512
db52bff9796bb478fc50186dec50d137220d2d1f42ef848c97a34e7d4ec251833cd34123cdc54b52623868bf5a37f340c3497f5828c783fd23d2e2da310f943d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c053ec4c3cdeb5adda7264fbee8d2244

SHA1
8d2bffd116370292ec6b44216f65e5c19e5b4905

SHA256
45b7349c306af5196c13db9ba0bf67b41aff95c76188fdbcbf897be5784acb6c

SHA512
4fd11fc57dbb07dc02a28907bc6a760463547354bbf68bdea01fa9ca7135d8d6e2f22bd90a58f19204811f08d56beb4dfaf2fc6e781d830605a1c1111993d39d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
231b464a48b3035bf62ac115af68f81b

SHA1
2733be3b0473742b13fc1e68c4f480853fa9e219

SHA256
7474c8ee3dfd091dcc9b26eea42e138d46c67dc64bcf6e53a55106e938ece42d

SHA512
1cd2c883c6ec4e65e759cd72b08180f45e6407af0d7521f54632f8e48b7b8b23f09c5068a7ea769806391621de58518c3bfee387ae3bb38c309138d25a0482c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d994dc4c7d1719753b89c50b51fc606

SHA1
aac9afd2a198f3fc0027277e8fbc55908d5ca7a8

SHA256
3f4c5d908f14c6bce81f85e003cbb57c9eb67e689c5b039991daf80c368b100d

SHA512
5b2a323e4f4ac9872fc7d1bd4c7878dd3755a10f7585daf9e27457aeb3facd3c23b5a3411d69838c9f7c8866e6cdb4b686984fdf1869a85a9fb6510d3724d642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2530caadc33afcd310f0956609336f85

SHA1
7361e2d1c1775ea2e6ad284aeb022042d90d7421

SHA256
1357c270c5e37f18cabd4289718b3fa059c5199afd1b7fbcb52e27b046dbc1bd

SHA512
e451a8df92765706268ed33cde00e5b9a88426419c1c3a2f7c61c41e9856ff0ece7cb7fd57f6f721bf2d1968a27de8dd3cefd8009eb580ae6a52e5d2fdf057ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d5a1fd5d1757f9dcf50b43fad6aed28

SHA1
f106512a2558355dc697b202614b5fe9afcf1557

SHA256
75ec571466291b2cb27b60744775b35d96824bf2e5dd1afca421a2432ebcbe2b

SHA512
d8eb3eb2b25d5c3b9473457c9d9ab19aaaf73df09e7e53c5beb5b7cc1cdeea2479f7081704eb534b75e98c56bb16d1c95035545476deb8e9a5df56e3c8e1be69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f1ccdef3f59c0b6986e1b22391d3a9e

SHA1
ebc840ed00ee88c7b7d57ff61500008e322972a7

SHA256
69563c03f8564534e1cd963231cf1ef3848cbc60062eb7eaf8c0212203313a1d

SHA512
b0cb8bab15993d1797f7e0086f58688f6d57b02760c6a2b4fcc6b9f6d16ee5f551f4e22c18653428d27f91f3ac1c8f515a06777314122936fc167391000a1f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6161efdb93d7540d83467350fae2e7b3

SHA1
cfd5cf753b771ef52ba3c657a32ed78e21a8913b

SHA256
bb03c491c542780c4134b3198aa38efdc06a49414a57a6cdebde42494529b08b

SHA512
6d371e6fc96b0a4e1ea2f32ddb82f52813861ba559349f65b7fc12a5f27d1bb2430f287728502776b05c94bfca5a7c18e074c1313cd4c9811a35b40c14174d14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4821ba4188a0da0672b6be59beee2ad8

SHA1
8dae66cdb88a73ab6993b2651b659fba36c841b9

SHA256
54461e7f120756b2abd251eae834cf91b342b755883a595988ca3ec4ca14c99d

SHA512
47e4216864397bfd112958d582b22b93a8fb5ff0f6f62da0aee4b96ddff6ed04a444db163369facec96a6359576e6b2bee6a0e7280bd82854047457dd9a5a710

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab171A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar179C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit